DHCPv6 OPERATIONAL ISSUES Tom Coffeen 4/7/2016

Transcription

1 Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved. DHCPv6 OPERATIONAL ISSUES Tom Coffeen 4/7/2016

2 ABOUT THE PRESENTER Tom Coffeen IPv6 Evangelist Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

3 IPv6 STATISTICS Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

4 US INTERNET TRAFFIC TO GOOGLE VIA IPv6! 25% US Population: 323M US Internet penetration: 70% Number of Internet Users: 226M Percentage of IPv6 Users: 25% 18% of US population uses IPv6: 57 Million IPv6 users Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

5 US IPv6 NETWORK OPERATOR STATS! Comcast 44%! T-Mobile 49%! AT&T 56%! Verizon 70%! Source: Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

6 2016: IPv4 AS HISTORIC? "IPv4 has been superseded by IPv6, and is therefore Historic." "The term does not indicate that the practice is harmful, but that there will be no further development in IPv4, and therefore those using the old version are advised to transition to the newer version." "The term IP, without address family specified, is assumed to mean IPv Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

7 WORLDWIDE IPv6 BY 2018 >50%! A similar estimate has worldwide Internet traffic to Google over IPv6 at greater than 50% by Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

8 A BRIEF DHCPv6 REVIEW Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

9 COMPARING DHCPv4 WITH DHCPv6 Characteristic DHCPv4 DHCPv6 Address type used for server discovery/solicitation Broadcast Multicast Default gateway Obtained from server Provided by RA DHCP transaction acronym DORA (Discovery, Offer, Request, Acknowledgement) Host Identifier MAC address DUID SARR (Solicit, Advertise, Request, Reply) Source Address/Port , 68 (UDP) link-local, 546 (UDP) Destination Address/Port , 67 (UDP) ff02::1:2, 547 (UDP) Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

10 THE DHCP UNIQUE IDENTIFIER (DUID) Used by DHCPv6 instead of the MAC address to identify clients and servers One, unique DUID per client One, unique DUID per server Variable in length Set at boot time (persistent across reboots) Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

11 THE IDENTITY ASSOCIATION (IA) Used by the DHCPv6 server to identify, group, and manage sets of related, assigned IPv6 addresses Client interfaces have multiple IPv6 addresses One IA is assigned per interface Since IPv6 addresses can be temporary or nontemporary, separate IAs are created for each category IA_NA for non-temporary addresses IA_TA for temporary addresses Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

12 STATEFUL VS. STATELESS DHCPv6 Characteristic Stateful DHCPv6 Stateless DHCPv6 IPv6 Address via DHCPv6 server via SLAAC Additional DHCP options (DNS servers, domain-search list, etc) via DHCPv6 server via DHCPv6 server Default gateway Provided by RA Provided by RA Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

13 DHCPv6 IN ACTION IPv6 Host A has a valid (tested with DAD) link-local address (derived from its MAC address) 1 Host A Ethernet MAC: 89-4B-3E-86-5E-DB Link-local IPv6 address: fe80::894b:3eff:fe86:5edb Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

14 DHCPv6 IN ACTION DHCPv6 Solicit Source: fe80::894b:3eff:fe86:5edb Destination: ff02::1:2 IPv6 Host A sends a DHCPv6 Solicit to the linklocal scope all-dhcp-servers multicast address 2 DHCPv6 Server Host A Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

15 DHCPv6 IN ACTION DHCPv6 Server DHCPv6 Advertisement Source: link-local of server interface Destination: fe80::894b:3eff:fe86:5edb A listening DHCPv6 server responds with a unicast DHCPv6 Advertisement addressed to the link-local address of the soliciting client 3 Host A Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

16 DHCPv6 IN ACTION DHCPv6 Request Source: fe80::894b:3eff:fe86:5edb Destination: link-local of Router A 4 Host A unicasts a DHCPv6 Request to the server DHCPv6 Server Host A Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

17 DHCPv6 IN ACTION DHCPv6 Server DHCPv6 Reply Source: link-local of server interface Destination: fe80::894b:3eff:fe86:5edb The DHCPv6 server responds with a unicast DHCPv6 Reply containing the IPv6 address and any additional network configuration options 5 Host A Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

18 DHCPv6 IN ACTION DHCPv6 Reply information DHCPv6 Server IPv6 Address DNS servers Domain-search list Host A Global Unicast Address: 2001:db8:21:12::100 Link-local IPv6 address: fe80::894b:3eff:fe86:5edb IPv6 Host A configures an IPv6 address and other network parameters from the information provided in the DHCPv6 Reply Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

19 DHCPv6 PREFIX DELEGATION /56 allocation: /64 assignment 2001:db8:1:aaa1:1e55:70ff:d2fe:a1e2 Home user ISP DHCPv6 Server ISP CMTS 2001:db8:1:aa00::/56 Cable modem/router 2001:db8:1:aaa1::/ Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

20 DHCPv6 PREFIX DELEGATION (HOMENET) /48 allocation: /60 assignment ISP DHCPv6 Server ISP CMTS Cable modem/router Home network 2001:db8:1::/ :db8:1:aaa0::/ :db8:1:aaa1::/64 Internet 2001:db8:1:aaa2::/64 Utilities 2001:db8:1:aaa3::/64 Security Etc Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

21 THE DHCPv6 CONTEXT Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

22 DHCPv6 ENVIRONMENTS Corporate LAN environments When additional administrative control is needed Wherever DHCPv4 is deployed today* Where Prefix Delegation (PD) is needed Stateless DHCPv6 might be used where the clients do not support Stateful DHCPv Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

23 MANAGING DHCPv Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

24 IPv6 AUTO-ADDRESSING FLAG SETTINGS Auto-address Configuration Method ICMPv6 RA (Type 134) A Flag M Flag O Flag SLAAC Stateless DHCPv Resulting IPv6 Addresses Configured Link-local, IPv6, Temporary IPv6 Link-local, IPv6, Temporary IPv6 Additional Configuration Options (DNS servers, domain search list, etc.) Manual (unless client supports RFC 6106/RDNSS) DHCPv6 Stateful DHCPv6 0 1 N/R Link-local, DHCPv6 DHCPv Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

25 IPv6 AUTOADDRESSING: STRANGE BEHAVIOR Host State Input Behavior Host has not acquired any addresses Host has not acquired any addresses Host has acquired address from DHCPv6 only Host has acquired address from SLAAC only No RA RA with M=0, O=1 RA with M=0 RA with M=1 Some popular OSes acquire DHCPv6 addresses. Some popular OSes acquire other info from DHCPv6 addresses. Others do so only if A=1. Some OSes release DHCPv6 immediately. Some release upon expiry. Some OSes release DHCPv6 immediately. Some release only if SLAAC address expires and can t be refreshed Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

26 DHCPv6 CLIENTS: STRANGE BEHAVIOR Scenario! OS X! Windows 7/8/10! A=0, M=0, O=0, DHCPv6 present! No address! DHCPv6! Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

27 DHCPv6 RELAY Custom provisioning of DHCPv6 info for a particular client or client type or circuit ID Classes can now be created based on DHCPv6 relay-provided options (rather than just client-provided options) Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

28 Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved. DHCPv6 RELAY

29 DHCPv6 FAILOVER Often repeated that it s not needed (unless you re doing PD) No proprietary implementation (yet ) Many enterprises are insisting on it: We do it this way in IPv4 and we want to be able to do it the same way in IPv6. Existing RFCs RFC 6853 DHCPv6 Redundancy Deployment Considerations RFC 7031 DHCPv6 Failover Requirements New Draft DHCPv6 Failover Protocol Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

30 FAILOVER WORKAROUND: SPLIT PREFIXES Lease DB Over time, uneven distribution of leases Server 1 Server 2 Server n+1 Client 1 Client 2 Client n+1 Server 1 Prefix = 2001:db8:1:1::/64 Pool = 2001:db8:1:1:0000::/65 Pref = 255 Server 2 Prefix = 2001:db8:1:1::/64 Pool = 2001:db8:1:1:8000::/65 Pref = 0 Server n+1 Prefix = 2001:db8:1:1::/64 Pool = <varies> Pref = <0-255> RFC DHCPv6 Redundancy Considerations Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

31 FIRST-HOP SECURITY: DHCPv6 GUARD Trusted DHCPv6 Server DHCPv6 relay Rogue DHCPv6 Server DHCPv6 Solicit Destination: ff02::1:2 Target Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

32 FIRST-HOP SECURITY: DHCPv6 GUARD Trusted DHCPv6 Server DHCPv6 relay Rogue DHCPv6 Server DHCPv6 Advertisement Server preference = 0 (default) 2001:db8:1::3f Target DHCPv6 Advertisement Server preference = 255 (must prefer) fc00:a:b:c:d:: Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

33 FIRST-HOP SECURITY: DHCPv6 GUARD Trusted DHCPv6 Server Switch with IPv6 FHS enabled (DHCPv6 Guard) DHCPv6 relay Rogue DHCPv6 Server DHCPv6 Advertisement Server preference = 0 (default) 2001:db8:1::3f Target DHCPv6 Advertisement Server preference = 255 (must prefer) Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

34 ADDRESS PLANNING FOR DHCPv6 Rules of address planning generally shouldn t change regardless of which autoaddressing method used (i.e., stateful or stateless DHCPv6 or SLAAC) /48 per site /64 per VLAN How the /48 is carved up within the site depends on the topological complexity (or lack of it) in the site Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

35 DHCPv6 FOR ANDROID! Pros It s a DHCPv6 client for Android! Cons Requires root i.e., not manageable for enterprise deployments Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

36 DDI WITH IPv6 General IPv4/IPv6 feature parity! DHCPv6 (Stateful and stateless)! DNS queries! DNS responses over v6! AAAA records! IPAM/DHCP networks/ ranges! Fixed addresses! Hosts dual stack! IPv6 NetMap! IPv6 Discovery! GUI/API/SNMP! Gateway discovery! RIR allocation and updates! Transition technology! DNS64(NAT64)! Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

37 IPv6 Address Planning, O Reilly Media, 2015 For IT network architects, engineers, and administrators! Comprehensive overview and current best-practices for designing, deploying, and maintaining an effective IPv6 addressing plan! Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved.

38 Infoblox Inc. All Inc. Rights All Reserved. Rights Reserved. Q&A